1. Scope and roles
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Chad and Gabsy Pty Ltd (ABN 70 633 285 631), Victoria 3104, Australia (“Provance”, “we”) and the customer organisation (“you”). It applies whenever we process personal data in your content on your behalf.
For that personal data you are the controller (or a processor acting for your own client) and we are your processor. For account, billing and website data we are a controller, as described in our Privacy Policy.
“Data protection law” means every law that applies to the processing, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection.
2. Details of the processing
| Subject matter | Providing the Provance service under the Terms of Service |
|---|---|
| Duration | The term of the agreement, then until deletion under section 8 |
| Nature and purpose | Hosting, storing, de-identifying, generating, checking, versioning and exporting customer content, and keeping the evidence records of that work |
| Categories of data subjects | The customer's users, and any people whose personal data the customer puts into its content (for example in documents, prompts or conversations) |
| Categories of personal data | User account data (name, email address, role); any personal data in customer content. Customers should not upload special categories of data unless their use is lawful and they have told us |
| Frequency of transfer | Continuous, for as long as the customer uses the service |
3. What we do as your processor
- We process the personal data only on your documented instructions. The Terms, your settings and your use of the service are your instructions. We tell you if we believe an instruction breaks data protection law.
- Everyone we allow to process it is bound by confidentiality.
- We apply the security measures in section 9.
- We help you answer requests from people exercising their rights (access, correction, deletion and others), mainly through the export, correction and deletion features of the service.
- We help you with data protection impact assessments and consultations with a regulator, as far as they concern our processing.
- We make available the information you need to show that this DPA is being met.
4. Personal data breaches
We tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your personal data. We give you the information we have about its nature, likely consequences and the steps we are taking, and we keep you updated. We cooperate with your assessment and any notification under the GDPR or the Australian Notifiable Data Breaches scheme.
5. Sub-processors
You give us general authorisation to use the sub-processors on our Sub-processors page. We impose on each one, by written contract, data protection obligations that protect the data at least as well as this DPA, and we remain responsible to you for their work.
We give account owners at least 14 days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may end the affected service and we refund any prepaid fees for the unused period.
6. International transfers and the standard contractual clauses
Provance is hosted in Australia (Amazon Web Services, Sydney region). Some sub-processors process data in other countries, as listed on the Sub-processors page.
Where you transfer personal data to us that is subject to the GDPR, and no adequacy decision covers the transfer, the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (“the SCCs”) apply and are incorporated into this DPA by reference, as follows:
- Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer.
- Clause 7 (docking clause) applies.
- Clause 9: option 2 (general written authorisation) applies, with the notice period in section 5 of this DPA.
- Clause 11: the optional language does not apply.
- Clause 13: the supervisory authority is the one competent for you under the GDPR, or, if you have no establishment in the EU, the authority of the Member State where your representative is established.
- Clauses 17 and 18: the law and the courts of Ireland.
- Annex I is section 2 of this DPA (the parties are those named in section 1); Annex II is section 9; Annex III is the Sub-processors page.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with the tables completed from this section. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent authority being the Swiss Federal Data Protection and Information Commissioner. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.
We plan to offer an Australia-only option, in which all processing, including hosted AI models, stays in Australia.
7. Audits
On request we give you the information you reasonably need to check that we meet this DPA, including the results of our own security checks. Where that is not enough, or a regulator requires it, you may audit us once a year, at your cost, with at least 30 days' notice, during business hours, and under confidentiality.
8. Return and deletion
You can export your content at any time while your account is open. When your account closes, personal data that no legal minimum period covers is deleted at closure and is gone from our backups within 90 days. Records that Australian law, or another law or standard that applies, requires us to keep are retained only for that period, protected under this DPA, and then deleted, as set out in the “How long we keep it” section of our Privacy Policy.
9. Security measures
- Encryption in transit (TLS) for all traffic, including connections to the database.
- Encryption at rest for the database and its backups.
- Each organisation's data is kept separate, and access is checked on every request.
- Role-based access inside each organisation; production access limited to authorised staff.
- Personal details are removed from text before it is sent to any hosted AI model.
- Daily backups kept for 35 days, with deletion protection on the database.
- An audit trail of significant actions, and append-only evidence records.
- Monitoring and alarms for availability, errors and unusual activity.
10. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where data protection law or the SCCs do not allow a limit. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. Questions about this DPA: [email protected].